On a Tuesday in May the report shows 812 sessions. Monday was 47, Wednesday is back to 51. The shop sells fly-fishing gear and ships to the US and Canada; the 812 sessions come from Singapore, all on the same landing page, average engagement time per session is zero seconds, and nobody added anything to a cart.
This piece shows you how to identify those sessions as bot traffic beyond doubt, which report you need for it (the one by hostname, which almost nobody builds), in which order the countermeasures work, and why the obvious reaction wrecks your year-over-year comparisons for twelve months.
What GA4 filters out by itself and what still gets through
Part of the job GA4 does without you: traffic from known bots and spiders is excluded automatically, based on Google's own detection and the IAB International Spiders and Bots List. That filtering runs on every property, cannot be switched off and cannot be inspected. No report tells you how much it removed.
The list catches what identifies itself, or what is notorious enough to be on it. The second category falls through:
- Automated browsers. A script driving a real headless Chrome runs your measurement code just like a person.
- Uptime monitors and security scanners. The homepage every five minutes, around the clock, roughly 8,600 hits a month.
- Link checkers and messenger previews. Somebody shares your URL, the service fetches the page for a preview card.
- SEO crawlers, including your own. A crawl with JavaScript rendering across 400 URLs produces 400 pageviews in your own property. The agency running its Monday check is one of the biggest distorters in a small account.
- Your own office. No bot, same effect.
Then there is a special class where nothing visited your site at all. Your measurement ID (G-XXXXXXXXXX) sits in every page's source, and anyone who copies it can send hits straight to Google's collection endpoint, never touching your server. That is ghost traffic, which is why a firewall does nothing: nothing arrives that could be blocked.
The hostname dimension: the report almost nobody builds
Every event in your property carries a hostname, the domain it was sent from. That dimension appears in no standard report, which is why hardly anyone looks. It answers a question nobody thinks to ask: is my website the only thing sending data?
Two minutes:
- In the left menu click Explore, then Blank.
- In the Variables column, next to Dimensions, hit the plus and import
Hostname. Same under Metrics withSessionsandEvent count. - Drag
Hostnameinto Rows, the metrics into Values, and set the range to the last three months.
If more than your own domain shows up, you have your explanation:
| What you see | What it means | What to do |
|---|---|---|
staging.yourdomain.com | The test environment is sending too, usually after a relaunch. | Remove the tag, or give staging its own property. |
localhost, 127.0.0.1 | Your own development work. Small numbers that look like abandoned carts. | Filter developer traffic. |
| A translation or proxy domain | A service mirrors your page, skewing language and country data. | Watch it. |
| An unfamiliar domain with your page paths | Somebody copied your site, measurement code included. | Exclude it. |
(not set) or a nonexistent domain | Ghost traffic with forged fields. Your site was never involved. | Exclude. |
Referrer spam, skewed averages, and when this actually hurts
Domains you never dealt with turn up under your referrals, with names that read like an advert. Which is precisely the point.
The realistic assessment, because a lot of nonsense circulates: referrer spam does not hurt your rankings. Google does not judge a site by what sits in its analytics account, and the linking pages usually do not exist. Anyone selling you an SEO risk here is selling fear.
What breaks is your averages. Bounce rate climbs even though no human bounced faster, because in GA4 it is just the inverse of engagement rate (the mechanics are in understanding bounce rate). Worst hit is conversion rate: the numerator stays put while the denominator grows. Ten enquiries out of 500 sessions is two percent, the same ten out of 1,300 is 0.77 percent, and you spend three weeks hunting a fault in your conversion tracking that is not there.
That also answers when to take this seriously. It is a question of scale, not principle. On a site with 500 sessions a month, 800 bot sessions ruin every statement you might make. At 200,000 sessions the same 800 are noise. Small sites have to measure more cleanly than corporations, not more sloppily.
How to spot bot traffic in GA4
One signal proves nothing, three together are conclusive. And the counter-check matters, because real traffic looks similar at first:
| Signal | Bots and spam | A genuine spike |
|---|---|---|
| Shape | jumps in one day, back to normal the next | rises over hours, decays over days |
| Origin | one country, often a single city | several countries, matching the source |
| Landing page | one only, sometimes a URL that never existed | a main page plus spread |
| Engagement time | zero, or identical everywhere | widely spread, with long outliers |
| Technology | one browser, one resolution, often a rare one | the usual mobile and desktop mix |
| Source | direct, or a domain you do not know | a source you can verify |
Two signals are especially damning. A landing page that does not exist on your site can only be forged: a real visitor would have got an error page, and that error page would be in the report. And identical session durations never happen with humans. What a plausible spread looks like, and why a real zero is not automatically a bot, is in showing engagement time in GA4. How to read these reports is in reading GA4 reports.
The countermeasures, in the order that works
Sorted by effect per effort. Almost nobody has done step one.
First: exclude internal traffic. On a small website the biggest single distorter is not the bot from Singapore, it is your own office. Three staff, a boss checking in the evening, the agency with its crawler: in an account with 500 sessions a month that is easily 15 percent. Two stages, and most people stop after the first: Admin → Data collection and modification → Data streams → your web stream → Configure tag settings → Show all → Define internal traffic → Create. Name the rule, leave internal as the value for traffic_type, put your office address under IP address. Then activate the matching data filter under Admin → Data collection and modification → Data filters.
Second: limit the hostnames you accept. Two tools, two effects, and everyone conflates them. In a tag manager you condition your GA4 tag on the built-in page hostname variable, so it only fires on your own domains. That covers copied pages, proxies and staging, but not ghost traffic, which never loads your page. For that you want the Web hostname traffic data filter, added to GA4 in mid-2026. It only excludes; there is no allowlist, so you add hostnames as they appear.
Third: create the developer traffic filter. It catches events carrying debug_mode or debug_event, everything from a debug session. Two clicks, and the sessions from testing the order form disappear.
Fourth: block server-side where it pays off. The only measure that also cuts server load, and it catches everything that touches your server: scrapers, scanners, aggressive crawlers, via a rule in your CDN or firewall. Handle it carefully, or you lock out search engines too.
What is deliberately missing: List unwanted referrals in the tag settings. Guides love recommending it against referrer spam, and that is wrong. It blocks nothing. It only tells GA4 not to start a new session attributed to that domain, so the same sessions land in your reports as direct. You end up with an inflated direct channel you cannot explain next time (what else that channel collects is in direct traffic in GA4). It exists for self-referrals, like a payment provider in checkout. Against spam it is the wrong tool.
Why GA4 data filters are not retroactive
A GA4 data filter takes effect the moment you activate it, and only going forward. What came in yesterday stays in, permanently. Google is blunt: excluded data is never processed and will not be available later. This is not a pair of glasses, it is a door.
You excluded internal traffic and two hostnames on 12 June. In July you compare June with May and see a 14 percent drop. It is not real, it is the filter, but in the report it reads like a collapse. Your time series has a step on that date, and nothing in GA4 reminds you.
So write down the date of every filter activation. And for historical data, use comparisons and segments instead: in the standard reports, Add comparison builds a condition that excludes the country or hostname behind the spike, and you read the cleaned-up curve next to the raw one. In an exploration you build the same as a segment. Neither deletes anything, both are reversible, and both reach back to your first day of collection.
The second trap costs weeks: data filters start in the Testing state. In testing mode nothing is excluded. GA4 only tags the affected events with the Test data filter name dimension so you can see what the filter would catch. Useful for the first days, but it also means people create the filter, tick it off mentally, and find out a month later that their own visits are still in the reports. After two or three days, set it to Active.
Why Googlebot and GPTBot never show up in GA4
Search and AI crawlers normally do not appear in GA4 at all. Not because they get filtered out, but because they do not execute your measurement code. GA4 measures through JavaScript in a browser, and GPTBot, ClaudeBot, PerplexityBot and their relatives generally fetch raw HTML only. Googlebot does render JavaScript, but Google does not count it in Analytics.
If you want to know who really crawls you, GA4 is the wrong tool; the answer is in your server logs, and which names to look for is in controlling AI crawlers. The reverse also holds: a pile of suspicious traffic in GA4 is almost never a search engine bot, it is an automated browser, a scanner or a forged hit. The hunt starts with the hostname, not the well-known bot names.
Where to start
- Build the hostname exploration, three-month range. If anything other than your domain shows up, you have your explanation.
- Set up internal traffic with your office IP and your agency's. The data filter then has to go from Testing to Active.
- Write down the activation date.
- For the spike in the past, build a comparison or a segment instead of despairing.
- Only then the fine work: hostname condition in the tag manager, developer traffic filter, a CDN rule if needed.
After that a number in the report means something again. Before, optimisation is a bet on noise.
Frequently asked questions
How do I spot bot traffic in GA4?
Look for the pattern. Suspicious is a jump on one day, from one country, on a single landing page, with zero engagement time and always the same browser and screen resolution. Three at once are conclusive. The fastest check is a hostname exploration.
Does GA4 filter out bots automatically?
Yes, but only the known ones, using Google's own detection and the IAB International Spiders and Bots List. You can neither switch that off nor inspect it. Anything that does not identify itself as a bot gets through: automated browsers, uptime monitors, scanners and forged hits.
What is referrer spam, and does it hurt my SEO?
Referrer spam is referrals from domains you never dealt with, whose names advertise some offer. It does not hurt your rankings, because Google does not judge a site by what sits in its analytics account. It hurts your metrics: a channel looks bigger, and the denominator behind bounce and conversion rate grows.
Why do I suddenly have lots of visitors from a country I do not sell to?
That is the most common face of bot and ghost traffic. Check engagement time for those sessions (zero, or identical everywhere), the landing page (usually just one) and the hostname in an exploration. Genuine cases exist, a link in a foreign forum say, but then landing pages and durations spread out.
How do I exclude my own IP address from GA4?
Under Admin, Data collection and modification, Data streams, your web stream, Configure tag settings, Show all, Define internal traffic, create a rule: a name, internal as the value for traffic_type, plus your IP address. Then, under Data filters, switch the internal traffic filter from Testing to Active. Otherwise the traffic is tagged but not excluded.
Are GA4 data filters retroactive?
No. A data filter applies from the moment you activate it, and only forward. Excluded data is never processed and is not available later. Your time series gains a step on that date.
Can I remove bot traffic from past data?
Deleting it is not possible; GA4 cannot filter already-collected events after the fact. Hiding it works: in the standard reports, Add comparison builds a condition excluding the affected country or hostname, and in an exploration you build the same as a segment.
Why do Googlebot and GPTBot not show up in GA4?
Because GA4 measures through JavaScript in a browser and these crawlers do not execute your measurement code. They fetch raw HTML only, which is not enough for a session. To know how often they come by, read your server logs.
What does an unfamiliar hostname in my GA4 reports mean?
That events carrying your measurement ID were sent from a domain that is not yours. Four explanations cover nearly every case: a staging environment still sending, localhost from your own work, a proxy or translation service mirroring your page, or somebody else's copy of your site. The fifth is forged hits, recognisable by a hostname that matches nothing real.